======================================================================
opencart v1.5.1.1 CRLF injection/HTTP response splitting Vulnerability 
======================================================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=0
0    .    .--.   .--.   .---.      .                  1
1  .'|        )      )      /      |                  0
0    |     --:    --:      /    .-.| .-.  .  .        1
1    |        )      )    /    (   |(   ) |  |        0
0  '---'  `--'   `--'    '      `-'`-`-'`-`--|        1
1                                            ;        0
0     Site            : 1337day.com        `-'        1
1     Support e-mail  : submit[at]inj3ct0r.com        0
0     >> Exploit database separated by exploit        1 
1           type (local, remote, DoS, etc.)           0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=1

#######################################################

           # Vendor: http://www.opencart.com/

                 # Date: 2011-07-27 

                # Author : indoushka 

            +++=[ Dz Offenders Cr3w ]=+++

         # KedAns-Dz * Caddy-Dz * Kalashinkov3
 
      # Jago-dz * Kha&miX * T0xic * Ev!LsCr!pT_Dz 

           # Contact : ind0ushka@hotmail.com

     # Tested on : win SP2 + SP3 Fr / Back | Track 5 fr

########################################################################  
                                                                                                                                                                                                
# Exploit By indoushka 
-------------

CRLF injection/HTTP response splitting :

Vulnerability description:

This script is possibly vulnerable to CRLF injection attacks. 

HTTP headers have the structure "Key: Value", where each line is separated by the CRLF combination. If the user input is injected into the value section without properly escaping/removing CRLF characters it is possible to alter the HTTP headers structure.
HTTP Response Splitting is a new application attack technique which enables various new attacks such as web cache poisoning, cross user defacement, hijacking pages with sensitive user information and cross-site scripting (XSS). The attacker sends a single HTTP request that forces the web server to form an output stream, which is then interpreted by the target as two HTTP responses instead of one response. 
This vulnerability affects /upload/index.php. 
Discovered by: Scripting (CRLF_Injection.script). 
The impact of this vulnerability
Is it possible for a remote attacker to inject custom HTTP headers. For example, an attacker can inject session cookies or HTML code. This may conduct to vulnerabilities like XSS (cross-site scripting) or session fixation. 
How to fix this vulnerability
You need to restrict CR(0x13) and LF(0x10) from the user input or properly encode the output in order to prevent the injection of custom HTTP headers.

Dz-Ghost Team ===== Saoucha * Star08 * Cyber Sec * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ===========================
special thanks to : r0073r (inj3ct0r.com) * L0rd CruSad3r * MaYur * MA1201 * KeDar * Sonic * gunslinger_ * SeeMe * RoadKiller 
Sid3^effects * aKa HaRi * His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * r1z * D4NB4R * www.alkrsan.net 
MR.SoOoFe * ThE g0bL!N * AnGeL25dZ * ViRuS_Ra3cH * Sn!pEr.S!Te 
---------------------------------------------------------------------------------------------------------------------------------